CVE-2026-56772

Name of the Vulnerable Software and Affected Versions NewsBlur versions prior to 14.5.0

Description Broken access control allows authenticated users to read private notification feeds. By supplying arbitrary user id values to the 'GET /social/interactions' endpoint, an attacker can bypass ownership verification to access another user's follows, replies, and social activity through enumeration of user id values.

Recommendations Update to version 14.5.0 or later. Avoid using the user id parameter in the 'GET /social/interactions' endpoint to access data not owned by the authenticated user.